CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106490

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493

The Backstage developer portal framework is vulnerable to a path validation issue in its cloud storage catalog providers prior to version 1.54.6 . Specifically, the framework failed to sufficiently validate object paths, allowing a principal with permissions to create or rename objects in Azure B...

EUVD-2026-94013

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106490

The Backstage framework is vulnerable to an improper input validation flaw in the @backstage/plugin-techdocs-backend package prior to version 2.2.4 . When utilizing the Azure Blob Storage provider , an authenticated user may be able to access restricted TechDocs content if entity-level permission...

ClickOnceBlobber

ClickOnce AppDomainManager 注入工具包 通过 AppDomainManager 注入劫持依赖 DLL 并加载 C 移植的 ProxyBlob Agent，将已签名的 .NET ClickOnce 应用程序武器化，用于初始访问。附带 ProxyBlob 的 C 移植版本——一种通过 Azure Blob Storage 隧道传输所有流量的 SOCKS5 代理，可融入 .blob.core.windows.net 被列入白名单的环境中。 为什么有效 ClickOnce 是微软针对 .NET 应用程序的一键部署技术。当用户点击 .application URL...

goblob

Goblob 🫐 Goblob 是一款轻量且快速的枚举工具，旨在帮助发现 Azure Blob 中公开暴露的敏感信息，可用于漏洞评估、渗透测试和情报收集等各种研究目的。 警告 。Goblob 会为每个存储账户中的每个容器名称生成独立的协程，仅受 -goroutines 参数指定的最大并发协程数限制。在大多数情况下，使用默认词表时，这种实现方式会迅速耗尽带宽，或者如果您在云环境中使用该工具，可能会产生高昂的费用。运行该工具前，请确保您清楚自己在做什么。 安装 go install github.com/Macmod/goblob@latest 用法 使用 goblob 只需运行以下命令： ...

CVE-2025-10681

CVE-2025-10681：硬编码的 Azure Blob 存储帐户密钥 公告 字段| 值 ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6（高危） 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798（使用硬编码凭据） 研究人员| Michael Groberman — Gr0m 发布日期| 2026-02-24 产品 字段| 值 ---|--- 供应商| Gardyn 产品| Gardyn Home Kit 1.0, 2.0, 3.0,...

BlobHunter

BlobHunter 一个用于扫描Azure Blob存储账户中公开Blob的开源工具。 BlobHunter是 Hunting Azure Blobs Exposes Millions of Sensitive Files 研究的一部分。 概述 BlobHunter可帮助您识别那些存储了任何有互联网连接的人均可公开访问的文件的Azure Blob存储容器。 该工具通过识别配置不当且存储敏感数据的容器来帮助降低风险，在存在大量难以跟踪的存储账户的大型Azure订阅中尤其有用。 BlobHunter会生成一份信息丰富的CSV结果文件，其中包含扫描环境中每个公开容器的重要详细信息。 要求 1...

CVE-2026-55726

CVE-2026-55726: Contenedor de Azure Blob Storage Listable Públicamente registros de dispositivos Aviso Campo| Valor ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medio Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625: Improper Limitation of a Pathname to a Restricted Directory

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

CVE-2026-50173: Incorrect Authorization

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...